Page MenuHomeFreeBSD

rtld: more caution when parsing notes in digest_notes()
AcceptedPublic

Authored by kib on Sun, Sep 13, 10:17 AM.
Tags
None
Referenced Files
F171925372: D59635.diff
Mon, Sep 14, 3:46 PM
F171913540: D59635.id186578.diff
Mon, Sep 14, 1:17 PM
F171913431: D59635.id186580.diff
Mon, Sep 14, 1:16 PM
F171912885: D59635.diff
Mon, Sep 14, 1:10 PM
F171901325: D59635.vson.id186580.diff
Mon, Sep 14, 11:10 AM
Unknown Object (File)
Sun, Sep 13, 12:13 PM
Unknown Object (File)
Sun, Sep 13, 12:13 PM
Subscribers

Details

Reviewers
emaste
jrtc27
Summary
Incorrect ELF might have PT_NOTE slightly larger than the needed to
contain all notes, and the PT_NOTE size could be larger than one page.
Then rtld mmaps just the notes bytes to parse.  After the last note,
we iterate past the mapped region trying to read the Elf_Note header.
This was found in wild.

Require full Elf_Note to fit into the [start_note, end_note) region to
continue the parsing.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

kib requested review of this revision.Sun, Sep 13, 10:17 AM

Require whole note to fit into the mapped region, not only the header.

I can confirm that this patch fixes the problem for me. Tested on stable/15-n285266-30211e66b989

emaste added inline comments.
libexec/rtld-elf/rtld.c
1792

I personally find if statements that omit one of the components a bit confusing. No worries if you prefer it as is..

This revision is now accepted and ready to land.Mon, Sep 14, 11:55 AM